Repository navigation
[JENKINS-46652] Authorize Project blocks Pipeline Jobs when Computer/Build for master is lacking #22284
Description
Users may configure Authorize Build plugin with the intention to limit who can run builds on the master in a setup where just going to zero static executors is impractical (e.g. to run a periodic backup or other housekeeping).
In that case, Pipelines cannot even start if started by users lacking Computer/Build on master, as the flyweight task cannot run there (and it seems to be tied to master).
(Reproduction using role-strategy only, as matrix-auth is currently lacking per-agent configuration)
CC jglick
Originally reported by 
danielbeck, imported from: Authorize Project blocks Pipeline Jobs when Computer/Build for master is lacking
- assignee:
jglick
- status: Resolved
- priority: Major
- component(s): authorize-project-plugin, core, workflow-job-plugin
- label(s): permissions
- resolution: Fixed
- resolved: 2018-03-09T20:17:23+00:00
- votes: 1
- watchers: 5
- imported: 2025-11-24
Raw content of original issue
Users may configure Authorize Build plugin with the intention to limit who can run builds on the master in a setup where just going to zero static executors is impractical (e.g. to run a periodic backup or other housekeeping).
In that case, Pipelines cannot even start if started by users lacking Computer/Build on master, as the flyweight task cannot run there (and it seems to be tied to master).
(Reproduction using role-strategy only, as matrix-auth is currently lacking per-agent configuration)
CC jglick
Activity
jenkins-infra-bot commentedon Sep 5, 2017
Remote links associated with this issue:
jenkins-infra-bot commentedon Sep 8, 2017
Raw content of original comment:
It's a kind of "as designed" behavior. I workaround it by a combination of Permissive Computer.Build on any node to any user and restricting by Job Restrictions plugin: https://github.com/oleg-nenashev/demo-jenkins-config-as-code/blob/master/init_scripts/src/main/groovy/MasterComputer.groovy#L20-L42 . But it's a too complex setup, which requires manual whitelisting of classes.
It would be great a marker interface like "OnMasterFlyweightTask" which would allow tasks even when there is no Computer.Build permission for the current authentication. But such interface requires bumping of Jenkins core. Maybe a default "boolean isOnMaster()" in FlyWeight task solves it in a more compatible way
jenkins-infra-bot commentedon Sep 12, 2017
Raw content of original comment:
It is not as designed. BUILD should not be checked on flyweight tasks IMO, which is why the Node patch I proposed in
JENKINS-24513would fix this bug. I see no need for API changes.jenkins-infra-bot commentedon Mar 9, 2018
Raw content of original comment:
Code changed in jenkins
User: Jesse Glick
Path:
core/src/main/java/hudson/model/Node.java
core/src/main/java/hudson/model/queue/MappingWorksheet.java
http://jenkins-ci.org/commit/jenkins/9842a2795e81bbdb0aeb5039cd9953bbb0ff2531
Log:
JENKINS-46652Check Computer.BUILD permission only on heayweight tasks.jenkins-infra-bot commentedon Mar 9, 2018
Raw content of original comment:
Code changed in jenkins
User: Jesse Glick
Path:
core/src/main/java/hudson/model/Node.java
core/src/main/java/hudson/model/queue/MappingWorksheet.java
http://jenkins-ci.org/commit/jenkins/1f4f76ffcae89938aa9b95c23c025da3706d7150
Log:
Merge pull request #3254 from jglick/heavyweight-
JENKINS-46652JENKINS-46652Check Computer.BUILD permission only on heayweight tasksCompare: c84cbf3...1f4f76f
jenkins-infra-bot commentedon Mar 11, 2018
Raw content of original comment:
The patch has been integrated towards 2.111
jenkins-infra-bot commentedon Nov 24, 2025
[Original
relates_tofrom Jira: JENKINS-24513]